Beyond the Flag: A Framework for Integrating Cybersecurity Competitions into K-12 Education for Cognitive Apprenticeship and Ethical Skill Development

TL;DR

This paper introduces the ECAC framework, integrating cybersecurity competitions into K-12 education to promote ethical skills, broaden participation, and address educator gaps through a systematic, theory-based approach.

Contribution

It presents the ECAC framework, combining cognitive apprenticeship and ethical development, as a practical model for enhancing cybersecurity education in K-12 settings.

Findings

ECAC broadens participation among underrepresented groups.

The framework fosters deep, transferable cybersecurity skills.

It offers a sustainable model for educator engagement.

Abstract

Capture the Flag (CTF) competitions are powerful pedagogical tools for addressing the global cybersecurity workforce gap, yet their effective K-12 implementation is often undermined by significant barriers, including educator preparedness gaps and equity concerns. This paper addresses these challenges by proposing the Ethical-Cognitive Apprenticeship in Cybersecurity (ECAC) framework, a new model derived from a systematic Framework Synthesis of existing literature and empirical evidence. ECAC systematically integrates cognitive apprenticeship theory with embedded ethical development across five phases: (1) Foundational Modeling, (2) Scaffolding the Arena, (3) Coaching and Articulation, (4) Ethical Dilemma Injections, and (5) Reflective Exploration. The framework provides a "low floor, high ceiling" learning pathway designed to broaden participation among diverse student groups, including underrepresented minorities and women, while fostering deep, transferable skills. By reframing the educator role as a lead learner," ECAC also offers a sustainable solution to the teacher expertise gap. Ultimately, this framework provides a practical roadmap for transforming CTFs from standalone competitions into integral learning experiences that cultivate a more skilled, ethical, and diverse generation of cybersecurity professionals.